Explore CRA Product Categories
Review product categories and possible conformity-assessment routes. Confirm the category using the product's core functionality and the current legislation.
Main requirements apply from 11 December 2027. Article 14 reporting obligations apply from 11 September 2026.
Reference: Not listed in Annex III
Review Module A Eligibility
For products within CRA scope and outside the important or critical categories, Module A internal production control may be available. Confirm the product category first.
Route to review: Module A (Internal Production Control)
Use the questionnaire to identify architecture questions for further review.
Preliminary guidance: Compare the selected category with CRA Annexes III and IV. Classification depends on specific product features, core functionality, and intended use. Consult the official CRA text and legal counsel for definitive compliance advice.
Understanding CRA Categories
The CRA classifies products into four risk-based categories, each with different conformity assessment requirements.
Default Category
Products within CRA scope that do not fall into the important or critical categories.
Confirm the product's category and scope
Important - Class I
Product categories listed in Annex III, Class I.
Self-assessment depends on Article 32 conditions
Important - Class II
Product categories listed in Annex III, Class II.
Check permitted routes and exceptions
Critical
Critical product categories listed in Annex IV.
Check applicable acts and certification schemes
What Does This Mean For You?
Self-Assessment (Module A)
You declare conformity yourself without external auditor involvement. However, you must still:
- •Create and maintain Technical Documentation
- •Perform risk assessment and vulnerability testing
- •Issue EU Declaration of Conformity
- •Affix CE marking
- •Define and meet the applicable security support period
Notified Body Audit
A designated conformity-assessment body examines the evidence required by the selected procedure. Discuss:
- •Module B: Type examination of design and documentation
- •Module C: Production conformity verification
- •Assessment schedule and availability
- •Fees for the agreed scope and assessment procedure
- •Certificate scope, validity, and any continuing obligations
Start with the applicable requirements
Annex I requirements and the product's cybersecurity risk assessment inform the engineering work. The chosen conformity-assessment route determines the additional evidence and review process.
Frequently Asked Questions
What are CRA Annexes III and IV?
Annex III lists important product categories in Classes I and II. Annex IV lists critical product categories. The applicable conformity-assessment route depends on the product category and the conditions in Articles 8 and 32, including any applicable standards, certification schemes, and exceptions.
What is a Notified Body?
A Notified Body is a conformity-assessment body designated by an EU Member State for specified assessment activities. Its role depends on the applicable procedure. Scope, fees, timing, and required evidence need to be agreed with that body.
What should I check for a Class II product?
Class II products generally require third-party conformity assessment or an available, applicable European cybersecurity certification scheme. Article 32 includes specific routes and an exception for qualifying free and open-source software. Confirm the product category and applicable conditions before choosing a route.
Ready to Prove Compliance?
Whether you self-assess or need a Notified Body, you first need a technical gap analysis against CRA Annex I requirements.